nebi
02/20/2019, 9:12 PMprocess_namespaces
like this select * from process_namespaces
some of the processes do not have pid_namespaces
even pid1
does not have pid_namespace. Is this normal?8p8c
02/20/2019, 9:36 PMosquery> select version from osquery_info ;
version = 3.3.2
osquery> select * from process_namespaces limit 1 ;
pid = 1
cgroup_namespace = 4026531835
ipc_namespace = 4026531839
mnt_namespace = 4026531840
net_namespace = 4026531957
pid_namespace = 4026531836
user_namespace = 4026531837
uts_namespace = 4026531838
nebi
02/20/2019, 9:45 PM8p8c
02/20/2019, 9:45 PMnebi
02/20/2019, 9:45 PM8p8c
02/20/2019, 9:46 PMnebi
02/20/2019, 9:46 PM8p8c
02/20/2019, 9:47 PMnebi
02/20/2019, 9:56 PMosqueryi
8p8c
02/20/2019, 9:57 PMnebi
02/20/2019, 9:57 PMselect * from process_namespaces
8p8c
02/20/2019, 9:59 PMnebi
02/20/2019, 10:00 PMosqueryi
?8p8c
02/20/2019, 10:03 PMnebi
02/20/2019, 10:06 PM8p8c
02/20/2019, 10:08 PMnebi
02/20/2019, 10:13 PM